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BEIflUEURS 



Claims 1 - 20 are pending in the present Application. 
In the above-identified Office Action, the Examiner 
objected to the Specification because of some 
informalities. Claims 1, 6, 11 and 16 were rejected under 
35 U.S.C. §102 (e> as being anticipated by Porras et al. 
Claims 2, 7, 12 and 17 were rejected under 35 U.S.C. 
§103 (a) as being unpatentable over Porras et al. and 
further in view of Okada et al. Claims 3-5, 8-10, IS- 
IS and 18 - 20 were rejected under 35 O.S.C. §103 (a) as 
being unpatentable over Porras at al. and Okada et al. in 
view of Lienhard et al. 

The Examiner is thanked for the interview of i^ril 26, 
2005. During the interview. Applicants' attorney agreed to 
amend the preamble of the broadest claims (i.e.. Claims 1, 
6, 11 and 16) to define the term "network simulation" as 
well as to explain that XML is an acronym of extensible 
Markup Language. Consequently, Claims 1, 6, 11 and 16 have 
been amended . 

The Specification has also been amended to include the 
Serial Nos, o£ the Related Applications. The Specification 
is further amended to correct a typographical /grammatical 
error. 

For the reasons stated more fully below ^ J^plicants 
submit that the claims are allowable over the applied 
references. Hence, reconsideration, allowance and passage 
to issue are respectfully requested. 

As stated in the SPECIFICATION, most network 
application programs exchange data using data packets. A 
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packet has a specific structure that incorporates internal 
fields that clearly delineate the packets' different 
contents. Using this structural representation, a user may 
devise algorithms that may be used to effectuate network 
simulation testing to debug network problems etc. The 
algorithms n»ay be devised using a markup language, for 
example. A markup language is 8 language that allows 
additional text or tags that are invisible to users to be 
inserted into a document. Thus, the tags are not part of 
the content of the document but rather enhance the 
document. For example, the tags may be used to structure 
the document or to add hypertext capability to the document 
etc. 

one of the markup languages that is particularly well 
suited for this task is the extensible Markup Language or 
XML. XML is a language that is especially designed for Web 
documents. It allows designers to create their own 
customized tags. enabling definition, transmission, 
validation, and interpretation of data between applications 
and between organizations. 

Therefore, if connection establishment, transition 
state of each user data pecket and close connection 
procedures of a network communications protocol as well as 
the rules required to implement an XML document are known, 
a software program may be written to convert the 
communications protocol data transactions into an XML 
document. The transactions may be acquired, for example, 
through an existing application program such as TCPdump, 
iPtrace, IPreport etc. or through a network sniffer. 
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Thus, network cominunications exchanges between two 
network computers may be expressed using XML documents. 
Once an XML document that expresses a network 
communications exchange between two computers is generated, 
the content of the document may be changed to effect 
changes In the communication exchange. In other words, the 
XML document may be used to perform network protocol 
simulation. 

The present invention provides just such a method. In 
accordance with the teachings of the invention, network 
protocol data packets are used to generate an XML document. 
Then, changes are made in the document to perform network 
protocol simulation (see page 27, line 19 to page 28, line 

The invention is set forth in claims of varying scopes 
of which Claim 1 is illustrative. 

1. A method o£ pazformlng- natwoxk 
protocol almalation osln? •Xtea*l2>ie 
Mtarkv^ Laagamgm (XML) doawamab, the XML 

document representing network 

communication exchanges, the network 
protocol simulation including changes made 
in the XMli document to effect chsmgee in 
the network communication exchanges, the 
method comprising the steps of: 

generating an XML document using 
network protocol data packets; and 

pylpwfpnji- a pATt of tbm XML docuxnant 
to perform ta» Mtwor* pxotoaol 
sianlation. (Emphasis added.) 

The Examiner rejected the independent claims (i.e.. 
Claims 1. 6, 11 and 16) under 35 U.S.C. §102(e) as being 

AUS920010871US1 

Page 11 of 13 



PAGE 1«16'RCVDAT4I26I20I» 2:58:58 PM (Eastern OayligMrmel'SVItUSPTO^ 



Tuesday, April 26,-2005 1:59 PM 



Volel Emile. Esq. (512) 306-0240 



Appl- No. 10/006.059 

Amdt. dated 04/26/2005 

Reply to Office Action of 01/26/2005 

anticipated by Porras et al. Applicants submit that the 
claims, as now presented, are allowable over the appliecJ 
references. 

Porras et al. purport to disclose a network-based 
alert management system. According to the teachings of 
Porras et al., alerts from network sensors are received, 
consolidated, if the alerts are indicative of d coiwnon 
incident, and an output is generated reflecting the 
consolidated alerts. 

More specifically, sensors are used to monitor hosts 
and/or network activity within a network. Each sensor may 
generate a stream of alerts, triggered by potentially 
suspicious events, such network packet dat» transfer 

commands, data transfer errors, network packet data 
transfer volume, and so forth. The alert streams contain 
raw (i.e., unprocessed) alerts that may be formatted in a 
variety of formats, such as IDIP, SNMP, HP Openview, an 
XML-based standard format (such as the Attack 
Specifications from IETF), Common Intrusion Detection 
FramQwork (CIDF) , GIDOs, or some Other format. 

However, Porras et al. do not teach, show or suggest a 
method of cbming^ « f«xt of «n M docnaeaf! thet has been 
generated using network protocol data packets to prnxtoxm 
network pxotoaoJ. slfflulatlon as claimed. Indeed, Porras et 
al. have no reason to show the emboldened/italicized 
claimed element since their disclosure (contrary to the 
Examiner's assertion (see the first two lines of the second 
paragraph (or fifth paragraph of the Action) which is on 
page 3 of the Office Action of January 26, 2005)) is not 
directed to a method of ^ex£oza±ag nefcwor* protocol 
AUS920010871US1 

Page 12 of 13 

PAai5l16'RCVDAT4Q6)20ll5 2:58:58 PM [Eastern OayligMrmel'SV^^ 



Tuesday, April 26, 2005 1:59 PM 



Voiel Emile. Esq. (512) 306*0240 



Appl. No. 10/006,059 

Amdt dated 04/26/2005 

Reply to Office Action of 01/26/2005 



aimalatlon nsingr an XML docttm^nt but rather to a network- 
based alert management system. 

Since neither Okada et al- nor Lienhard et al., the 
other two applied references, purports to teach, show or 
suggest a method of changlaar a part o£ an XML doauBuant that 
has been generated using network protocol data packets to 
perfojna nmtwork protocol aijualAtlon as claimed, Applicants 
submit that Claim 1, as well as its dependent claims, are 
allowable. Independent Claims 6, 11 and 16, which all 
incorporate the above-emboldened-italicized limitations in 
the above-reproduced claim 1, together with their dependent 
claims are also allowable. Hence, Applicants once more 
respectfully request reconisideration, allowance and passage 
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